# Keyquill

> Securely store LLM API keys in your browser. Use your own keys from any web app without trusting their server.

Canonical page: [https://chrome-stats.com/d/keyquill](https://chrome-stats.com/d/keyquill)

## Overview

- **ID:** `keyquill`
- **Platform:** Firefox
- **Type:** Firefox add-on
- **Status:** Available
- **Publisher:** R-Okauchi
- **Category:** web-development,privacy-security
- **Daily users:** 1
- **Version:** 1.1.0
- **Last updated:** 2026-04-30
- **First published:** 2026-04-27
- **Size:** 2.10 MB
- **Data as of:** 2026-09-15
- **Store listing:** [Firefox Add-ons Store](https://addons.mozilla.org/firefox/addon/keyquill/)
- **Website:** [https://github.com/R-Okauchi/keyquill/issues](https://github.com/R-Okauchi/keyquill/issues)
- **Privacy policy:** [https://addons.mozilla.org/firefox/addon/keyquill/privacy/](https://addons.mozilla.org/firefox/addon/keyquill/privacy/)

## Description

<strong>Keyquill</strong> is a Bring-Your-Own-Key (BYOK) wallet for LLM APIs. You register your OpenAI, Anthropic, Gemini, or any OpenAI-compatible API key inside the extension. Approved web apps can then stream chat completions using your key — and neither the web app nor its server ever sees the key material.

The problem

Web apps that use LLM APIs usually make you either:
- Let them store your API key on their server (trust and breach risk)
- Paste your key into <code>localStorage</code> (XSS risk)
- Go without AI features

Keyquill offers a fourth option: keep the key in an isolated extension process, and let web apps request completions through a narrow, user-approved channel.

How it works
<ol><li>Click the Keyquill toolbar icon. Register a provider (OpenAI, Anthropic, Gemini, Groq, Mistral, DeepSeek, Together, Fireworks, xAI, Ollama, or any OpenAI-compatible endpoint) and paste your API key.</li><li>Visit any web app that integrates the Keyquill SDK.</li><li>First access triggers a consent popup showing the origin name. Approve or deny.</li><li>Approved apps can call for completions. The extension's service worker contacts the provider directly over HTTPS. The web page only receives the streamed response.</li></ol>
Security properties
<ul><li><strong>Keys live in <code>browser.storage.session</code></strong> — ephemeral, cleared when the browser closes, inaccessible to regular web-page JavaScript.</li><li><strong>Per-origin consent</strong> (MetaMask style). Every origin that uses Keyquill must be explicitly approved via a popup. Approvals are stored in <code>browser.storage.local</code> and can be revoked from the extension popup at any time.</li><li><strong>Key registration and deletion are popup-only.</strong> Web pages cannot register, delete, or exfiltrate keys.</li><li><strong>Zero telemetry.</strong> The extension opens no connections to any Keyquill-controlled server (there isn't one). Network destinations are limited to LLM providers the user has chosen.</li></ul>
What's new in v1.0 — policy broker

Every request is brokered through a user-owned policy before reaching the provider:
<ul><li><strong>Model policy</strong>: allowlist / denylist / capability-only modes per key.</li><li><strong>Budget caps</strong>: per-request, daily, and monthly USD ceilings; choose block / confirm / warn.</li><li><strong>Privacy rules</strong>: HTTPS-only endpoints, provider allowlists, origin regex filters.</li><li><strong>Capability-first API</strong>: apps declare what they need (tool use, reasoning, long context); your policy picks the actual model.</li><li><strong>Consent popups</strong> for out-of-allowlist models or high-cost requests, with once/always/reject choices.</li><li><strong>Audit ledger</strong>: every request recorded locally with tokens + estimated + actual cost. Filter by origin, export to CSV, 90-day retention.</li><li><strong>Localized errors</strong> (English / Japanese).</li></ul>
Supported providers

Anything that speaks the OpenAI Chat Completions format works out of the box. Native translation is provided for the Anthropic Messages API.

Confirmed: OpenAI, Anthropic, Google Gemini, Groq, Mistral, DeepSeek, Together AI, Fireworks AI, xAI (Grok), Ollama (local), and any OpenAI-compatible endpoint.

For developers

Integrate Keyquill in your web app with the official SDK:

<code>npm install keyquill
</code>

<code>import { Keyquill } from "keyquill";
const quill = new Keyquill();
if (await quill.isAvailable()) {
  await quill.connect();
  const { completion } = await quill.chat({
    messages: [{ role: "user", content: "Hello" }],
    requires: ["tool_use"],
    tone: "precise",
    maxOutput: 1024,
  });
}
</code>

v1 SDK users can keep pinning <code>keyquill@0.3.x</code> — the extension accepts both wire shapes.

Full documentation: <a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/3e1e246372b74289b3e0286f9c04cd919ade804ac59920770fb995909008c342/https%3A//github.com/R-Okauchi/keyquill" rel="nofollow">https://github.com/R-Okauchi/keyquill</a>

Links
<ul><li>Live demo: <a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/236660238f1f4124e08f92ff656bc61467f7b2e11d4aed4f207e9a25d91e0d4a/https%3A//r-okauchi.github.io/keyquill/demo/" rel="nofollow">https://r-okauchi.github.io/keyquill/demo/</a></li><li>Source code (MIT): <a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/3e1e246372b74289b3e0286f9c04cd919ade804ac59920770fb995909008c342/https%3A//github.com/R-Okauchi/keyquill" rel="nofollow">https://github.com/R-Okauchi/keyquill</a></li><li>Privacy policy: <a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/0b5eaa73694aa8e5fb0d521346bff18c7228e8fb887ff5dfd28c40441db04d0e/https%3A//r-okauchi.github.io/keyquill/privacy-policy" rel="nofollow">https://r-okauchi.github.io/keyquill/privacy-policy</a></li><li>Report issues: <a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/52a43447cb3b48a190f016b1f95ebd8b9407262d49bb3380f4978f2c3a27ca6a/https%3A//github.com/R-Okauchi/keyquill/issues" rel="nofollow">https://github.com/R-Okauchi/keyquill/issues</a></li></ul>

## Rankings

- #99,886 — Overall
- #35 — metamask

## Permissions and access

### Permissions

- `storage`
- `activeTab`

### Content script matches

- `*`

## Safety

- **Risk impact:** Moderate risk impact
- **Risk likelihood:** High risk likelihood

### Analysis details

- Allows access to all websites, posing a significant security risk as it can monitor and modify data from any visited site.
- This extension has low user count. Unpopular extensions may not be stable or safe.

> Some risk analysis details are omitted from this free response. [Upgrade to view the full analysis](https://chrome-stats.com/pricing).

## Similar extensions and apps

- [Byoky](https://chrome-stats.com/d/byoky) — 4 users
- [Noice - LLM Assistant](https://chrome-stats.com/d/noice-llm-assistant) — 1 users
- [Rallx browser AI](https://chrome-stats.com/d/rallx-browser-ai) — 5 users
- [Locki](https://chrome-stats.com/d/locki) — 2 users, 5.00 / 5
- [QuickLLM](https://chrome-stats.com/d/quickllm) — 21 users, 5.00 / 5
- [AI Firewall](https://chrome-stats.com/d/ai-firewall) — 1 users
- [Sequirly - Stop AI Data Leaks](https://chrome-stats.com/d/sequirly-detect-sensitive-info) — 1 users
- [AI Assistant Sidebar](https://chrome-stats.com/d/ai-assistant-sidebar) — 4 users
- [ChromeClaw - Personal AI Assistant in Browser 🦞](https://chrome-stats.com/d/chromeclaw) — 13 users, 5.00 / 5
- [Hacker News TL;DR](https://chrome-stats.com/d/hacker-news-tl-dr) — 1 users
- [Sqreen - DLP for AI Tools](https://chrome-stats.com/d/sqreen-dlp-for-ai-tools)
- [AI Website Translation](https://chrome-stats.com/d/ai-website-translation) — 1 users

---

Source: [Chrome-Stats](https://chrome-stats.com/d/keyquill)